A company has just acquired an intrusion detection system (IDS) whose detection capabilities are based on behavior and baselines. The IDS has not been in production long enough to establish…

A company has just acquired an intrusion detection system (IDS) whose detection capabilities are based on behavior and baselines. The IDS has not been in production long enough to establish baselines or to understand what constitutes normal activity. This lack prevents the CSIRT from making what determination regarding a breach?